Safety assessment of the Loviisa nuclear power plant

Transcription

1 / OCTOBER 2007 B Safety assessment of the Loviisa nuclear power plant Statement regarding the licence application by Fortum Power and Heat Oy concerning the operation of the Loviisa nuclear power plant Säteilyturvakeskus Strålsäkerhetscentralen Radiation and Nuclear Safety Authority

2 / OCTOBER 2007 Safety assessment of the Loviisa nuclear power plant Statement regarding the licence application by Fortum Power and Heat Oy concerning the operation of the Loviisa nuclear power plant STUK SÄTEILYTURVAKESKUS STRÅLSÄKERHETSCENTRALEN RADIATION AND NUCLEAR SAFETY AUTHORITY Osoite/Address Laippatie 4, Helsinki Postiosoite / Postal address PL / P.O.Box 14, FIN Helsinki, FINLAND Puh./Tel. (09) , Fax (09) ,

3 ISBN (print) Edita Prima Oy, Helsinki/Finland 2007 ISBN (pdf) ISSN

4 Safety assessment of the Loviisa nuclear power plant. Statement regarding the licence application by Fortum Power and Heat Oy concerning the operation of the Loviisa nuclear power plant. STUK-B 81. Helsinki pp. Keywords: Loviisa nuclear power plant, nuclear safety, safety assessment, periodic safety assessment, operating license renewal Executive summary In this safety assessment the Radiation and Nuclear Safety Authority (STUK) has evaluated the safety of the Loviisa Nuclear Power Plant in connection with application for the operating license renewal. This safety assessment provides a summary of the reviews, inspections and continuous oversight carried out by STUK. The issues addressed in the assessment and the related evaluation criteria are set forth in the nuclear energy and radiation safety legislation and the regulations issued thereunder. The provisions of the Nuclear Energy Act concerning the safe use of nuclear energy, safety and emergency preparedness arrangements, and waste management are specified in more detail in the Government Decisions and Regulatory Guides issued by STUK. Based on the assessment, STUK consideres that the Loviisa Nuclear Power Plant meets the set safety requirements with some reservations related to the redundancy and separation of components needed for performing safety functions. These reservations are originating from the design basis laid down during the 1970s. However, substantial modernisations have been carried out at the Loviisa Nuclear Power Plant since its commissioning to improve safety. During the current operating licence period, risk factors have been systematically identified and eliminated using operating experience, research and development and probabilistic risk analysis (PRA). Examples of such plant modifications are given in the assessment. Licensee has many ongoing projects for enhancing safety. This is in line with the principle of continuous improvement of safety provided in Section 27 of the Resolution 395/1991. In addition, section 28 of the Resolution 395/1991 allows considering expediency in evaluating technical solutions at nuclear power plant in operation. In addition to the implementation of the plant modernisation programme, STUK raised issues of special significance in ensuring safe operation of the plant during the next operating license period. These were related to the management of brittle fracture risk in the reactor pressure vessel, adequacy of ageing management programmes for electrical and I&C systems and components, adequacy of the organisation and monitoring of safety culture and effective utilisation of operating experience feedback. In conclusion, the prerequisites for safe operation of Loviisa Nuclear Power Plant and the related buildings and storage facilities required for nuclear fuel and waste management have been met. The application submitted by licensee for extending the operating licence to exceed the 30-year service life by 20 years is essentially based on the estimates made in the lifetime management programme. STUK required licensee to carry out two periodic safety reviews during the licence period. The first safety review shall be submitted to STUK for approval by the end of 2015, and the second safety review by the end of

5 4

6 Contents Executive summary 3 1 Introduction Safety-related regulations Structure of the safety assessment 9 2 Premises and definitions (Government Decision 395/1991) Section 1: Applicability Section 2: Definitions 11 3 General Principles (Government Decision 395/1991) Section 3: General objective Section 4: Safety culture Section 5: Quality assurance Section 6: Demonstration of compliance with the safety regulations Accident analyses Probabilistic risk analyses (PRA) 16 4 Regulations concerning radiation exposure and releases of radioactive materials (Government Decision 395/1991) Section 7: Limitation of radiation exposure Section 8: Radiation safety of nuclear power plant workers Section 9: Limit for normal operation Section 10: Limit for an anticipated operational transient Section 11: Limit for a postulated accident Section 12: Limit for a severe accident 23 5 Design criteria for nuclear safety (Government Decision 395/1991) Section 13: Levels of protection Section 14: Technical barriers for preventing the dispersion of radioactive materials Section 15: Ensuring fuel integrity Section 16: Ensuring the integrity of the primary circuit Section 17: Ensuring containment building integrity Section 18: Ensuring safety functions Section 19: Avoiding human errors Section 20: Protection against external events and fires Section 21: Safety classification Section 22: Monitoring and control of a nuclear power plant Equipment qualification 40 5

7 (continued) 6 Operation of the Nuclear Power Plant (Government Decision 359/1991) Section 23: Technical Specifications and plant procedures Section 24: Operation and maintenance Plant operation Maintenance In-service inspections Currency of plant documentation Plant ageing management Section 25: Personnel Section 26: Monitoring releases of radioactive materials Section 27: Operating experience and safety research Operating experience from the previous operating licence period Operating experience feedback Safety research 58 7 Miscellaneous provisions (Government Decision 395/1991) Section 28: Nuclear power plants in operation Section 29: Detailed regulations 59 8 Physical protection (Government Decision 396/1991) 61 9 Emergency response arrangements (Government Decision 397/1991) Nuclear fuel management Nuclear waste management Handling, storage and disposal of reactor waste (Government Decisions 395/1991 and 398/1991) Handling, storage and disposal of spent nuclear fuel (Government Decisions 395/1991 and 478/1999) Decommissioning of plant units Handling of nuclear materials Other requirements The applicant s financial prerequisites to engage in operations International treaties Compliance with the conditions of the current operating licence of the plant Summary 74 6

8 1 Introduction Fortum Power and Heat Oy (FPH) has submitted an application to the Government in which the company applies for a licence referred to in section 20 of the Nuclear Energy Act: 1. to operate the power plant units Loviisa 1 and Loviisa 2 of the Loviisa Nuclear Power Plant, each with nominal thermal power of 1500 MW, for the purpose of producing electrical energy until 31 December 2027 for Loviisa 1, and 31 December 2030 for Loviisa 2; and 2. to use the buildings and storage facilities, as well as their necessary extensions, relating to Loviisa 1 and Loviisa 2 and required for nuclear fuel and nuclear waste management until 31 December In preparation for the issuance of the licence, the Finnish Ministry of Trade and Industry (MTI) has sent letter 6/330/2006, dated 6 November 2006 (No. A213/73), to the Finnish Radiation and Nuclear Safety Authority (STUK) requesting a statement regarding the application filed by FPH. FPH has filed with MTI an operating licence application, as well as the documents to be included in the operating licence application, as required according section 33 of the Nuclear Energy Decree. In addition, a number of other documents, to be submitted directly to STUK, are required for the periodic safety review included in the renewal of operating licence. The requirements concerning them are presented in Guide YVL 1.1. The periodic safety review is mainly based on the following documents referred to in section 36 of the Nuclear Energy Decree: 1. the final safety analysis report; 2. a probabilistic safety analysis; 3. a quality assurance programme for the operation of the nuclear facility; 4. the Technical Specifications, which shall at least define limits for the process quantities that affect the safety of the facility in various operating states, provide regulations on operating restrictions that result from component-failures and set forth requirements for the testing of components important to safety; 5. a summary programme for periodic inspections; 6. a description of the arrangements for physical protection and emergencies; 7. a description of how to arrange the safeguards that are necessary to prevent the proliferation of nuclear weapons; 8. administrative rules for the nuclear facility; and 9. a programme for radiation monitoring in the environment of the nuclear facility. According to section 36 of the Nuclear Energy Decree: When the application for an operating licence is made for a nuclear facility that has already been in operation, the documents mentioned in subsection 1 need be submitted to STUK only to the extent that they have not been submitted before. In addition, the applicant must submit to STUK any other information considered necessary by the Radiation and Nuclear Safety Authority. The documents referred to in section 36 of the Nuclear Energy Decree shall be continuously updated, and the updated versions shall be regularly submitted to STUK. According to Guide YVL 1.1, when applying for renewal of the operating licence, the documents may be submitted to STUK only insofar as they have been amended since the previous updates. The licensee shall also submit a periodic safety review of its own concerning the safety status of the nuclear facility, potential areas of development and maintenance of the safety. 7

9 According to Guide YVL 1.1, this assessment shall include: a report on fulfilment of the requirements laid down in Government Decisions /1991 and in the relevant YVL Guides a summary of the renewed safety analyses and conclusions drawn from their results experience of the facility ageing and ageing management a description of the licensee s safety culture and safety management a report on the actions required in Section 27 of Government Decision 395/1991 [operating experience and safety research] and on the consequent plant improvements a report on compliance with any terms of the operating licence a summary of fulfilment of the requirements laid down in Section 20 of the Nuclear Energy Act. The International Atomic Energy Agency (IAEA) has published the safety guide NS-G-2.10, Periodic Safety Review of Nuclear Power Plants, 2003, concerning periodic safety reviews. The guide lists the following 14 safety factors that are assessed in the safety review: plant design physical condition of the nuclear power plant qualification of equipment and structures ageing management deterministic safety analyses probabilistic safety analyses protection against external and internal hazards plant operating experience in terms of safety operating experience obtained from other plants and safety research findings organisation and administration plant procedures factors contributing to the work performance of people emergency planning radiological impact on the environment. According to Guide YVL 1.1, In making its own periodic safety review, the licensee shall verify that the safety factors proposed in the IAEA s guide [17] [NS-G-2.10, Periodic Safety Review of Nuclear Power Plants, 2003] have been taken into account to a sufficient degree in the safety review and other licence application documents. The said documents and reports have been filed with STUK in several batches and updated or otherwise supplemented in the course of the application process in response to the remarks presented by STUK. This Safety Assessment presents the basis for STUK s statement. This Safety Assessment provides a summary of the reviews concerning the issues and documents relating to the operating licence application, inspection of the safety review presented by the licence applicant and the results of the continuous oversight carried out by STUK. 1.1 Safety-related regulations Sections 5 to 7 of the Nuclear Energy Act (990/1987) contain the following safety provisions: Section 5, The use of nuclear energy, taking into account its various effects, shall be in line with the overall good of society; Section 6, The use of nuclear energy must be safe; it shall not cause injury to people, or damage to the environment or property; Section 6a, Nuclear waste generated in connection with or as a result of use of nuclear energy in Finland shall be handled, stored and permanently disposed of in Finland [ ]; and Section 7, Sufficient physical protection and emergency planning as well as other arrangements for limiting nuclear damage and for protecting nuclear energy against illegal activities shall be a prerequisite for the use of nuclear energy. This Safety Assessment covers all the aspects of the operation of the Loviisa 1 and 2 nuclear power plant units that fall within STUK s mandate. The issues to be addressed in the Safety Assessment and the related evaluation criteria are set forth in the nuclear energy and radiation safety legislation and the regulations issued thereunder. The provisions of the Nuclear Energy Act concerning the safe use of nuclear energy, safety and emergency preparedness arrangements, and waste management are specified in more detail in the Government Decisions applicable to each field of activity and issued under Section 81 of the Nuclear Energy Act. The resolutions are: General Regulations for the Safety of Nuclear Power Plants (395/1991) 8

10 Physical Protection of Nuclear Power Plants (396/1991) Emergency Response Arrangements at Nuclear Power Plants (397/1991) Safety of a Disposal Facility for Reactor Waste (398/91), and Safety of Disposal of Spent Nuclear Fuel (478/1999). The YVL Guides published by STUK set out even more detailed safety requirements. STUK continually evaluates the currency of the nuclear safety regulations in relation to current international developments, particularly within the framework of the International Atomic Energy Association IAEA and the Western European Nuclear Regulators Association WENRA. The currency of the YVL Guides is checked regularly at about five-year intervals. The principle regulations governing the field of nuclear energy that is, the Nuclear Energy Act, the Nuclear Energy Decree and the Government Decisions on the general regulations for the safety, physical protection and emergency preparedness of nuclear power plants, and for the safety of a disposal facility for reactor waste and disposal of spent nuclear fuel have, with the exception of the latter of the above, been issued between the late 1980s and early 1990s. Section 80, paragraph 1 of the new Constitution of Finland, which entered into force at the beginning of March 2000, requires that principles governing the rights and obligations of private individuals and the other matters that, under the Constitution, are of a legislative nature shall be governed by Acts. On the basis of the above, the Ministry of Trade and Industry initiated a project for revising the nuclear energy legislation in cooperation with STUK. The objective and task of the project is to amend the nuclear energy legislation so that it fulfils the requirements laid down in the Constitution. In particular, the regulation level of certain regulations relating to nuclear safety and the authorisation provisions of the Nuclear Energy Act are under consideration. The regulations relating to the export and import of nuclear products and goods and the decommissioning of nuclear facilities will be reviewed and supplemented when required during the course of the project. The legislation will also be technically updated in other relevant respects. A Government proposal to amend the Nuclear Energy Act, as well as the Government decrees on the amendment of the Nuclear Energy Decree and on general regulations for the safety of a nuclear power plant, physical protection concerning the use of nuclear energy, emergency preparedness arrangements at nuclear power plants and the safety of the disposal of nuclear waste will be prepared in connection with the project. According to preliminary estimates, the changes concerning nuclear energy legislation are planned to enter into force at the beginning of The assessment concerning the renewal of the operating licence for the Loviisa 1 and 2 nuclear power plant units shall be carried out based on the currently effective legislation. However, the impact of the planned changes on the assessment has been considered in the summary of the safety assessment (Section 14) by assuming that the changes were already in effect. 1.2 Structure of the safety assessment In this Safety Assessment, matters relating to nuclear safety are discussed in the same order as they are presented in the Government Decision 395/1991. In addition, the discussion also covers matters that are proposed to be transferred from the YVL guides onto the decree level in connection with the amendment of the Nuclear Energy Act and Government Decrees. These additions relate to the qualification and service life management of equipment and structures, handling and storage of nuclear waste and nuclear fuel, and decommissioning of a nuclear power plant. In addition, matters relating to Government Decisions 396/1991, 397/1991, 398/1991 and 478/1999 are also discussed, as well as the compliance with the terms of the current operating licence of the plant. This Safety Assessment also discusses those preconditions laid down in section 20 of the Nuclear Energy Act that have not been separately included in the current Government Decisions but the assessment of which nevertheless falls within the mandate of STUK. Relating to the above, section 20, paragraph 1, point 4 concerns, among other things, the applicant s financial prerequisites to engage in operations; although this point primarily falls within the mandate of other authorities, STUK nevertheless presents its observations concerning the cover for nuclear liability, preparations for nuclear waste 9

11 management costs and the operations FPH in the current conditions of the open electricity market. In accordance with section 20, paragraph 1, point 4, this Safety Assessment also discusses the fulfilment of Finland s international contractual obligations concerning nuclear material safeguards, nuclear safety and nuclear waste management. The relevant text from the Government Decision is quoted at the beginning of each section in italics. Direct quotations from other regulations are likewise presented in italics. If necessary, a brief description of the practical applications of the requirements in the Government Decisions and the more detailed criteria presented in the YVL Guides is provided. Each section includes an evaluation of how the related requirements are implemented at the Loviisa 1 and 2 nuclear power plant units. Special attention will be paid to the question of whether the nuclear facility meets the safety requirements set, that the physical protection and emergency planning are sufficient, that the necessary control to prevent the proliferation of nuclear weapons has been arranged appropriately, and that the licensee of the nuclear facility has, as provided, arranged indemnification regarding liability in case of nuclear damage (Nuclear Energy Act, section 20, paragraph 2, point 1). A summary of the results of the review is presented at the end of the Safety Assessment. 10

12 2 Premises and definitions (Government Decision 395/1991) 2.1 Section 1: Applicability In this decision general regulations relating to the safety of nuclear power plants equipped with a light water reactor are given. In terms of their basic design, the Loviisa 1 and 2 nuclear power plant units are VVER-440 light water reactors. 2.2 Section 2: Definitions In this decision: 1. dose (more precisely, effective dose) shall refer to the weighted sum of the equivalent doses of tissues and organs subjected to radiation, where the equivalent dose denotes the product of the mean energy absorbed per unit mass in the tissue or organ and of the radiation weighting factor; 1. dose commitment shall refer to the time integral of the dose rate reaching to a separately defined period of time; 2. criticality accident shall refer to such an accident during which an uncontrolled chain reaction of fissions caused by neutrons arises; 3. quality assurance shall refer to all planned and systematic actions necessary to provide adequate confidence that a component, plant or activity will satisfy given requirements; 4. anticipated operational transient shall refer to a deviation milder than an accident from normal operational conditions which can be expected to occur once or several times during any period of a hundred operating years; 5. accident shall refer to a deviation from normal operating conditions which is not an anticipated operational transient. Accidents are grouped into two classes: 6. postulated accident means an event which serves as a design basis for the engineered safety systems of a nuclear power plant. The nuclear power plant shall withstand a postulated accident without severe fuel damages and without radioactive releases that would require extensive measures for restricting the exposure of the general public; and 7. severe accident means an event during which a considerable part of the fuel in the reactor is damaged; 8. probabilistic safety analysis shall refer to estimates and calculations based on experience and probabilistic methods which address the reliability of operation of nuclear power plant systems, potential accident sequences, reactor damage, accident propagation and releases of radioactive materials; 9. safety functions shall refer to functions important from the safety point of view the meaning of which is to prevent the emergence or advancement of transient and accident conditions or to mitigate the consequences of accidents; the most important safety functions are reactor shutdown, residual heat removal from the reactor to the ultimate heat sink and the functioning of the containment building; and 10. nuclear power plant shall refer to a nuclear installation equipped with a nuclear reactor which is intended for electricity generation, or, if several such or other nuclear installations have been placed on the same site, the entity of installations formed by them. This Safety Assessment makes use of the definitions specified in the Government Decision 395/

13 3 General Principles (Government Decision 395/1991) 3.1 Section 3: General objective The general objective is to ensure nuclear power plant safety so that nuclear power plant operation does not cause radiation hazards which could endanger the safety of workers or of the population in the vicinity or could otherwise harm the environment or property. This objective is defined in section 6 of the Nuclear Energy Act. More detailed requirements for measures required to ensure safety are also included in sections 6a, 7 and 20 of the Nuclear Energy Act (see section 14, Summary), Government Decisions 395/1991, 396/1991, 397/1991, 398/1991 and 478/1999, YVL Guides issued by the Radiation and Nuclear Safety Authority, and radiation safety legislation. The above-mentioned regulations form the basis of this Safety Assessment. This Safety Assessment gives an evaluation of the attainment of the general objective laid down in section Section 4: Safety culture When designing, constructing and operating a nuclear power plant, an advanced safety culture shall be maintained which is based on the safety-oriented attitude of the topmost management of the organisations in question and on the motivation of the personnel towards responsible work. This presupposes well-organised working conditions and an open working atmosphere, as well as the encouragement of alertness and initiative in order to detect and eliminate factors which endanger safety. The significance of a safety culture as an important factor affecting safety has been widely acknowledged since the 1990s. The development of a safety culture is a continuous learning process carried out in slightly different ways in different utilities due their different approaches. The safety culture prevailing in organisations does not remain unchanged but is constantly changing due to internal and external reasons. Changes are introduced to procedures and attitudes by, among other things, personnel turnover, changing economic conditions and developments in technology. Because the safety culture is constantly changing, it is essential that FPH and the Loviisa Nuclear Power Plant retain the capacity for assessing, developing and maintaining their safety culture. In line with an advanced safety culture, the management of FPH and the Loviisa Nuclear Power Plant have documented their commitment to nuclear and radiation safety in the documents serving as operating guidelines. Annual planning is strategy-based, the consequence of which is that safety objectives are being used as criteria for long and short-term planning of operations and resourcing. In line with an advanced safety culture, the Loviisa Nuclear Power Plant has systematic procedures in place through which the personnel are motivated towards responsible work (e.g. inroduction, training, communications, plant procedures and monitoring of supervisors). However, in its OSART (Operational Safety Review Team) review in 2007 the International Atomic Energy Agency IAEA observed deficiencies in the visibility of safety management and compliance with procedures. STUK will monitor the implementation of the corrective measures taken and development plans prepared on the basis of these observations. The Loviisa Nuclear Power Plant has procedures in place for selecting, instructing and supervising contractors and subcontractors. The power plant aims at developing long-term co-operation with its suppliers. The objective is to raise the subcontractors knowledge of the plant and its procedures to ensure it is sufficient. The cooperation between Loviisa Nuclear Power Plant, part of 12

14 the Fortum Generation business unit, and Fortum Nuclear Services Ltd has been significantly improved during the present operating licence period, and these efforts should be further continued in the future. With regard to successful preconditions for a safety culture, development needs have been observed in the working conditions at the Loviisa Nuclear Power Plant concerning, for example, housekeeping as well as workspaces and locker facilities. These deficiencies have been adequately addressed by means of a development programme relating to occupational safety and plans relating to workspaces. Different types of reporting practices promote initiative and alertness to raise nuclear and radiation safety issues. The organisation attempts to identify possible nuclear and radiation safety risks. FPH has at its disposal a variety of tools (e.g. QA activities, atmosphere surveys, appraisal discussions and external reviews) for obtaining information about the current state of the safety culture. However, extensive follow-up targeting the safety culture of the entire operating organisation of the Loviisa Nuclear Power Plant has not been implemented, nor is such follow-up planned for implementation in the reports submitted in connection with the operating licence renewal. The conclusion to the above is that attempts are being made to maintain an advanced safety culture at FPH and the Loviisa Nuclear Power Plant in line with the basic intention of section 4 of the Government Decision. However, systematic work for promoting safety culture with the help of experts in organisational research has not been conducted at FPH. In future, FPH must pay more attention in the monitoring and further improvement of the state of the safety culture. STUK will monitor the subsequent developments of the safety culture in connection with its regulatory work. 3.3 Section 5: Quality assurance Advanced quality assurance programmes shall be employed in all activities which affect safety and relate to the design, construction and operation of a nuclear power plant. The Quality Assurance Programme of the Loviisa Nuclear Power Plant refers to the entity described in the quality assurance manual for operations and in the procedures required for implementing the programme. The quality assurance requirements and procedures to be adhered to when procuring nuclear fuel and planning its use are defined in the nuclear fuel quality assurance manual. All sections of the quality assurance manual for operations have been revised and approved by STUK during , and the sections of the nuclear fuel quality assurance manual during respectively. The procedures for implementing the quality assurance measures have been submitted to STUK for information. The organisations of the licensee participating in nuclear operations, the Generation business unit as a whole, and the Loviisa Nuclear Power Plant and Fortum Nuclear Services Ltd (FNS) within it, have a shared quality policy for nuclear operations, while each of the above have separate management systems that interrelate in an appropriate manner. The Generation business unit has an environmental certificate in accordance with SFS-EN ISO-14001:2004, which also comprises the operations of the Loviisa Nuclear Power Plant. FNS has a quality management system certificate in accordance with SFS EN ISO-9001:2000. During the present operating licence period the quality management system of the Loviisa Nuclear Power Plant has been developed in several ways according to the experience gained and the general development trend of quality management. Examples include: reflecting the impact of changes on the organisation and work duties at the Loviisa Nuclear Power Plant in the administrative and operating procedure system and emphasising the role of management in the procedures extensive update to emergency procedures and development of procedures for severe accidents development of new occupational health and safety system and its integration with the certified environmental system development of information systems and utilising them in document management development of laboratory quality system establishing a separate inspection organisation at Loviisa Nuclear Power Plant in 2001 development of investment and refurbishment project procedures as well as modification and design procedures. A project for developing a process-oriented operating model was initiated at the Loviisa Nuclear 13

15 Power Plant in The description of the quality management system in the form of process diagrams was completed during The objective is that the development of the quality management system and the improvement of operations over the next few years are to be carried out on the basis of the process diagrams. STUK has conducted regular inspections on the implementation of the quality system at the Loviisa Nuclear Power Plant. During the current operating licence period, no such deficiencies relating to the fundamentals or structures of quality management that would have essential significance to safety or operations affecting quality have been observed. FPH has appropriately processed and rectified the single deficiencies observed in the implementation of quality management. The quality management system and its efficiency have also been assessed by organisations other than STUK. IAEA conducted the OSART (Operational Safety Review Team) inspections targeted at the operating activities at the Loviisa Nuclear Power Plant in 1990 and Other assessments of quality management include, for instance, a number of self-assessments on the basis of various quality standards, the Peer Review inspections by WANO (World Association of Nuclear Operators), certification inspections concerning the management of environmental matters, a number of focused inspections carried out by different organisations, the plant s own annual inspections, and the independent reviews of the Loviisa Nuclear Power Plant ordered by the licensee. The conclusion to the above is that FPH has exposed its operations to external assessment according to the distinctive features of an advanced quality system, and that such inspection and assessment activities have been comprehensive during the operating licence period. The quality management system of the Loviisa Nuclear Power Plant meets the set requirements and is up to date. The undergoing project for describing operating processes creates improved preconditions for monitoring, assessing and developing operations affecting safety. The organisation and its operational preconditions, as well as the implementation of the quality system, is also discussed in several other sections of this Safety assessment. In summary, it can be stated that activities relating to the quality management system of the Loviisa Nuclear Power Plant have been arranged in manner referred to in section 5 of the Government Decision. 3.4 Section 6: Demonstration of compliance with the safety regulations If compliance with the safety regulations cannot be directly ascertained, fulfilment shall be demonstrated by the necessary experimental and calculational methods. Nuclear power plant safety and the design of its safety systems shall be substantiated by accident analyses and probabilistic safety analyses. Analyses shall be maintained and revised if necessary, taking into account operating experience, the results of experimental research and the advancement of calculating methods. The calculating methods employed for demonstrating that the safety regulations are met shall be reliable and well qualified for dealing with the events in question. They shall be applied so that the calculated results are, at a confident estimate, less favourable than the results which are considered best estimates. Furthermore, analyses which picture the likely course of transients and accidents shall be conducted for the purpose of probabilistic safety analyses and for the development of emergency operating procedures Accident analyses Analyses are intended to prove the ability of the plant unit to safely overcome various transients and accidents. According to Guide YVL 2.2, the analyses shall focus on events that, by their nature and severity, cover various types of incidents and accidents as well as possible. The course of transients and accidents shall be analysed as a function of time, starting from the initiating event and ending in a safe and stable state. FPH has reviewed all analyses of transient and accident conditions presented in section 14 of the Final Safety Analysis Report for Loviisa Nuclear Power Plant and updated them to the extent required by modifications carried out at the plant or amendments to the requirements set by the authorities. After the granting of the valid operating 14

16 licence, Guides YVL 2.2 and YVL 6.2, for example, have been revised. These guides define the classification of initiating events, provide instructions on how to perform the analyses, and present the acceptance criteria for the analyses. As to plant modifications, the introduction of new emergency procedures, for example, has resulted in needs for renewing the accident analyses. The calculation methods used for calculating the plant s normal operating condition, transients and postulated accidents are primarily those developed in Finland. The methods have been qualified primarily by performing comparative calculations against the results measured using different methods and test equipment. The extent of the qualification is on a good level from an international perspective. Due to uncertainty relating to the accuracy of calculating methods, it is essential that sufficiently wide safety margins be applied when assessing the fulfilment of the analysis acceptance criteria. The analyses described in the safety analysis report, as well as the related topical reports, also present and justify the initial values used and the assumptions made affecting the end results of the analyses, as well as the sensitivity analyses carried out. STUK has reviewed the presented analyses and the methods used therein. In addition, STUK has commissioned independent comparative analyses. Sensitivity and comparative analyses are required for assessing and reducing the uncertainties relating to calculating methods and calculating assumptions in general. The analyses presented in the safety analysis report discuss anticipated operational transients and postulated accidents used as the design basis of the safety systems as well as the so-called severe accidents. Different types of transients and accidents have been further divided into classes. Each class contains a variety of accident sequences, and separate analyses have been presented for each. All safety-critical analyses include sensitivity analyses, often of considerable scope. Anticipated operational transients are disturbances that can be expected to occur at least once during the service life of the plant. On the basis of the review of the analyses, the following cases of operational transients have been reanalysed: stopping of one and three reactor coolant pumps, opening of secondary circuit safety relief valve, and stopping of main feedwater pump. The results of the renewed analyses meet the acceptance criteria set for operational transients in all respects. According to Guide YVL 2.2, postulated accidents are divided into two classes according to the estimated frequency of the initiating event: level 1 postulated accidents; frequency /year, and level 2 postulated accidents; frequency less than 10 3 /year. FPH has classified the postulated accidents on the basis of the above and reanalysed the following cases resulting from level 1 postulated accidents: feedwater pipe break and steam generator heat transfer tube rupture (without the loss of off-site power). The following cases of level 2 postulated accidents have been reanalysed: steam generator heat transfer tube rupture (with the loss of off-site power), large break primary-to-secondary leak small and large break loss of coolant accident, and uncontrolled actuation of control rods from zero power with failure of automatic scram. FPH has also supplemented the overpressure protection analyses and renewed the analysis of boron dilution with regard to small break loss of coolant accident. The results of the renewed analyses meet the acceptance criteria set for postulated accidents in all respects. The accident analyses assessing the operability of safety systems are discussed in more detail in section 5.3 in terms of reactor core and fuel, and in sections 4.4 and 4.5 in terms of radiation safety. Transient and accident analyses, and the methods of analysis used therein shall be maintained and developed throughout the service life of the nuclear power plant. On the basis of the results of the analyses, safety-enhancing measures shall be taken as required. Nearly all of the analyses of transient and accident conditions will be updated in connection with the automation renewal that is to be implemented at the Loviisa Nuclear Power Plant 15

17 over the next few years. In connection with the conceptual design plans for the functional changes to be implemented during the course of the renewal, FPH has already carried out and submitted to STUK a number of analyses to justify these changes. Over the next few years, FPH will also prepare analyses of the so-called extensions of postulated accidents. The primary purpose of these analyses is to ensure that there are no such conditions immediately outside of the actual design basis the plant is incapable of managing safely. The conclusion to the above is that the transient and accident analyses concerning the Loviisa Nuclear Power Plant have been prepared in a manner referred to in section 6 of the Government Decision Probabilistic risk analyses (PRA) In this connection, probabilistic risk analyses (PRA) refer to the probabilistic safety analyses as prescribed in section 36 of the Nuclear Energy Decree 161/1988 and in section 6 of the Government Decision 395/1991. PRA is used for systematically analysing the occurrence of transients and the operation of the safety functions required by them, while taking into account the possibilities for faults and errors, as well as their probabilities, in each system. Transients may originate from equipment failures, fires, floods, harsh weather conditions, earthquakes or human errors. Event sequences describing accident propagation resulting in reactor core damage are analysed in the PRA, and the probability for their occurrence is estimated. The PRA can be used for identifying such dependencies between systems that may otherwise remain unnoticed. The timing and probabilities of accident sequences resulting in reactor core damage are defined on level 1 of the PRA; the quantity, time and probability of the release of radioactive material into the environment is estimated on level 2 of the PRA. In the PRA, an initiating event is a single event that causes a transient and requires starting the plant safety functions. The initiating event can be an internal or external event. Internal initiating events are transients arising from component failures, loss of off-site power and human errors made by plant personnel. The flood initiating events are floods occurring inside the plant due to ruptures in piping or pressure vessels causing a transient and loss of components important to safety. The fire initiating events are fires occurring inside the plant site causing a transient. External initiating events are transients caused by weather phenomena and earthquakes as well as disturbances in the environment caused by human activity. The weather phenomena considered in risk analyses include strong wind, lightning, exceptionally high or low outdoor temperature, snowfall, high seawater temperature, high seawater level, and phenomena causing a clogging risk in the seawater systems, such as frazil ice (sudden subcooling of seawater) and excessive growth of algae. In addition, the impacts of offshore oil accidents are also analysed. Level 1 PRA Internal initiating events In terms of core damage frequency, the most important internal initiating events during power operation are leaks from the primary circuit outside containment and the loss of control room I&C facilities cooling. The core damage frequency caused by internal initiating events during power operation has decreased by approximately 50 % from the estimate of 1997, even though new significant risk factors have been identified during the development of the PRA model. The risk has been reduced by a number of plant modifications and changes to plant procedures. The most significant of these changes concern the reductions of risks arising from leaks outside the containment and leaks in the seals of reactor coolant pumps. During an annual maintenance outage, the most important internal initiating in terms of core damage frequency are dropping heavy loads in the reactor hall and losses of reactivity control. The analysis has been supplemented during the current operating licence period, while new risk factors relating to annual maintenance outages have been identified. A number of plant modifications have been made on the basis of the updated analyses, the most important of which being the changes relating to heavy load lifting routes and instructions, as well as the changes relating to the prevention of boron dilution implemented to ensure reactor sub-criticality. 16

18 Level 1 PRA - Flood risks (internal flooding) The flood risk analysis of Loviisa Nuclear Power Plant has been developed and supplemented by modelling, among other things, the feed water tank level and the plant modifications implemented during the current operating licence period. According to the analysis, the most significant floods are caused by a leak in the emergency cooling system inside the reactor building, leaks in the fire fighting water system inside the control room building, and leaks in the feed water system above the control room. The risk arising from floods has been reduced during the current operating licence period. The risk arising from leaks occurring in the feedwater system above the control room was reduced by changing the feed water piping material to more erosion-corrosion resistant, by installing jet shields and restraints for the possible occurrence of pipe breaks, and by improving the leaktightness and drainage of the level. Risks arising from leaks in the seawater systems and in the fire fighting water system were reduced by a number of plant procedure changes and plant modifications. The most important of these plant modifications included protecting the service water system pressure measurements against the impacts of flood, enhancing the drainage of and adding flood alarms to the cable room below the control room, and changing the sprinkler systems below the control room to manually actuated. The planned automation renewal will enhance the reliability of the cooling of reactor coolant pump seals, which will also reduce the risk arising from floods in the control room. The flood risk from the emergency cooling system and the seawater system will not essentially change as a result of the automation renewal. Level 1 PRA Fire risks The fire risk analysis of Loviisa Nuclear Power Plant has been developed and supplemented by modelling, among other things, the control room building and the plant modifications implemented during the current operating licence period. The analysis does not yet cover the modelling of reactivity accidents, pressure vessel brittle fracture and shutdown states. The majority of the risk caused by fires arises from leaks in the reactor coolant pump seals. The large risk share of reactor coolant pump seal leaks is due to the fact that the operation of the pumps involves a large number of cables and a seal leak can be the result of fires in several rooms. The plant modifications carried out in order to ensure the cooling of seal water have not significantly reduced the risk of seal leak arising from fires. The risk arising from fires has been reduced during the current operating licence period. The improvement of the model and the several plant modifications carried out have both contributed to the reduction of the risk. Plant modifications for ensuring residual heat removal have been carried out during the operating licence period and, as a result, the operation of systems located in the turbine hall is no longer necessary. The risk significance of fires in the turbine hall has thus been reduced. Fire detector systems have been renewed, and fire extinguishing systems have been improved. Level 1 PRA Weather phenomena FPH has updated the weather risk analysis for power operation of the Loviisa Nuclear Power Plant during the current operating licence period and prepared a weather risk analysis for shutdown states. The weather risk analysis has been supplemented by a separate detailed oil risk analysis. The core damage frequency estimate arising from weather phenomena has decreased significantly during the current operating licence period. Among other things, this is due to the plant modifications carried out for preventing the complete clogging of the seawater system. The modifications will be continued in 2007, after which seawater intake will be possible from the outlet side as well. Backup of the cooling of reactor coolant pump seal water independent of the seawater system has been implemented at the plant during the current operating licence period, which reduces the risk of seal leak caused by clogging of the seawater intake. After the plant modifications, the most important external phenomena are clogging of the seawater system during outage caused by an offshore oil accident and high seawater level (+2.5 m above average water level) during power operation. Other risk-relevant external phenomena include strong wind, lightning and clogging of the seawater system caused by algae and frazil ice. 17

19 Level 1 PRA - Earthquakes Apart from slow land uplift, the Finnish bedrock is stable. The occurrence of dangerous earthquakes in Finland is considered extremely unlikely, but very weak earthquakes are observed relatively often. Loads caused by earthquakes have not been separately accounted for in the design of the Loviisa Nuclear Power Plant. Instead, other load cases were considered to cover them to a sufficient extent. It has since turned out that earthquakes may present a significant risk factor for nuclear power plants in areas of low seismic activity if the horizontal forces caused by earthquakes have not been considered at all in the design of components and their supports, for example. However, no items particularly sensitive to earthquakes have been detected in the Loviisa Nuclear Power Plant. The earthquake resistance of the Loviisa Nuclear Power Plant was assessed in a seismic risk analysis completed in The main elements of the analysis are the estimation of the annual frequency of earthquakes of varying magnitude on the basis of seismologic measurement data and historical observations, building vibration analyses and definition of peak accelerations on different floor levels, and estimation of the probability of structural damage in earthquakes of different magnitude. The seismic resistance of the structures, systems and components of the Loviisa Nuclear Power Plant was generally considered good. The feed water tank supports and certain direct current power systems were considered the seismically most sensitive items. On the basis of the analysis, the core damage frequency resulting from earthquakes is relatively small. The number of accumulated accurate measurement observations has increased and methods for estimating the frequency of rare earthquakes have been developed globally during the past 15 years. Various investigations carried out in different conjunctions have produced slightly different earthquake frequencies for the Loviisa area. The calculation methods for building vibration analysis have also advanced. Although the above-mentioned factors are not likely to have essential significance for the conclusions concerning the earthquake risks of the Loviisa Nuclear Power Plant, there is a justified reason to update the analysis early on during the next operating licence period. Level 2 PRA Level 2 PRA for the Loviisa Nuclear Power Plant has been significantly improved and supplemented with further detail during the current operating licence period. The model for migration of radioactive material has been renewed. Level 2 PRA has been supplemented by flood and weather events during power operation and preliminary estimates on fire and seismic events during power operation. In addition, the risk resulting from internal initiating events during an outage has also been preliminarily assessed. Initiating events during outage comprise the majority of the frequency of a major release. The PRA is not yet comprehensive in this regard. Major release in this connection refers to a release exceeding the limit for a release arising from a severe accident as defined in section 12 of Government Decision 395/1991. According to a preliminary estimate, the most important outage events in terms of the risk of a major release are dropping heavy loads when lifting heavy loads, reactivity increase, and floating of oil into the plant. During power operation, the most significant causes of release risk are internal initiating events. FPH has presented plans for plant modifications to be carried out on the basis of the current level 2 PRA results in order to reduce the frequency of a major release. These include, e.g., improving the reliability of break isolation in the control rod cooling piping, reducing the reactivity risk by means of on-line boron analyzers and development of instructions, identifying the opportunities for reducing the risks arising from heavy load lifting by means of crane modifications, as well as numerous instruction development efforts. Other significant renewal projects are also currently underway at the plant (for example, the automation renewal project LARA), the completion of which will further reduce the frequency of a major release. The majority of the modifications will be implemented during FPH has also presented a plan for supplementing the level 2 PRA analyses for the missing parts. The long-term objective is to improve plant safety based on the results of the analyses. The outage analysis will be carried out during , and STUK has required that the development of instructions for outage situations based on the results of the analysis is completed by the end of

20 Summary PRA has been used for systematically identifying and eliminating risk factors during the preceding and the current operating licence period. The Loviisa Nuclear Power Plant meets the target value for core damage frequency set for old plants by the International Atomic Energy Agency (IAEA), but fails to meet the numerical design objectives set for new power plants concerning core damage and major release frequency in Guide YVL 2.8 issued by STUK. STUK has set attaining a safety level as high as reasonably achievable as a target for nuclear power plants in operation. In the 1998 safety assessment STUK requested that the most significant risks be reduced. Safety has been improved by means of several plant modifications during the current operating licence period. Examples include ensuring the cooling of reactor coolant pump seals as well as improvements to the plant residual heat removal and emergency cooling systems. The PRA has indicated that it will be necessary to continue the safety improvement measures during the future operating licence period in, e.g., the following areas: Improvements aiming at preventing reactor coolant pump seal leaks shall be continued with regard to fire and flood conditions. Precautions against oil accidents in the Gulf of Finland shall be further improved by, e.g., developing the emergency preparedness for oilcombating in the neighbouring area and the instructions relating to outage situations. In order to decrease the possibility of a reactivity accident, the accidental migration of unborated coolant into the primary circuit shall be more reliably prevented. The risks arising for heavy load lifting shall be further reduced by improving the structural reliability of the crane and developing the procedures relating to lifting. Improvements to the containment systems for managing severe accidents were implemented during the current operating licence period of the Loviisa Nuclear Power Plant. However, the estimated risk of major release has not been significantly reduced because new accident sequences have been identified that are not included in the present severe accident management strategy. Relating to the above, it will therefore be necessary to carry out the following improvements during the future operating licence period: The risk arising from leaks from the primary circuit outside the containment shall be reduced. An example of these kinds of containment bypass sequences is a non-isolated leak in the cooling piping of the reactor control rod drive mechanism. The impact of external events (storm, lightning, earthquakes) and fires on the frequency of a major release shall be analysed in more detail. FPH has presented a long-term plan for reducing the accident and release risk, and for supplementing the existing PRA. STUK will monitor and oversee the implementation of the programme. On the basis of the above, it can be stated that FPH has justified the plant safety and safety engineering solutions in accordance with the requirements concerning probabilistic safety analyses presented in section 6 of Government Decision 395/